EP3905595A1 - Verfahren, vorrichtung und system zur überwachung einer industriesteuerung und computerlesbares medium - Google Patents

Verfahren, vorrichtung und system zur überwachung einer industriesteuerung und computerlesbares medium Download PDF

Info

Publication number
EP3905595A1
EP3905595A1 EP18944895.4A EP18944895A EP3905595A1 EP 3905595 A1 EP3905595 A1 EP 3905595A1 EP 18944895 A EP18944895 A EP 18944895A EP 3905595 A1 EP3905595 A1 EP 3905595A1
Authority
EP
European Patent Office
Prior art keywords
industrial
control system
network traffic
industrial control
monitoring
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Granted
Application number
EP18944895.4A
Other languages
English (en)
French (fr)
Other versions
EP3905595A4 (de
EP3905595C0 (de
EP3905595B1 (de
Inventor
Wen Tang
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Siemens AG
Original Assignee
Siemens AG
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Siemens AG filed Critical Siemens AG
Publication of EP3905595A1 publication Critical patent/EP3905595A1/de
Publication of EP3905595A4 publication Critical patent/EP3905595A4/de
Application granted granted Critical
Publication of EP3905595C0 publication Critical patent/EP3905595C0/de
Publication of EP3905595B1 publication Critical patent/EP3905595B1/de
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B23/00—Testing or monitoring of control systems or parts thereof
    • G05B23/02—Electric testing or monitoring
    • G05B23/0205—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults
    • G05B23/0259—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults characterized by the response to fault detection
    • G05B23/0262—Confirmation of fault detection, e.g. extra checks to confirm that a failure has indeed occurred
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/06—Generation of reports
    • H04L43/062—Generation of reports related to network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/50—Testing arrangements
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B19/00—Programme-control systems
    • G05B19/02—Programme-control systems electric
    • G05B19/04—Programme control other than numerical control, i.e. in sequence controllers or logic controllers
    • G05B19/042—Programme control other than numerical control, i.e. in sequence controllers or logic controllers using digital processors
    • G05B19/0428—Safety, monitoring
    • G—PHYSICS
    • G05—CONTROLLING; REGULATING
    • G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
    • G05B23/00—Testing or monitoring of control systems or parts thereof
    • G05B23/02—Electric testing or monitoring
    • G05B23/0205—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults
    • G05B23/0218—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults characterised by the fault detection method dealing with either existing or incipient faults
    • G05B23/0256—Electric testing or monitoring by means of a monitoring system capable of detecting and responding to faults characterised by the fault detection method dealing with either existing or incipient faults injecting test signals and analyzing monitored process response, e.g. injecting the test signal while interrupting the normal operation of the monitored system; superimposing the test signal onto a control signal during normal operation of the monitored system
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/06—Management of faults, events, alarms or notifications
    • H04L41/0631—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis
    • H04L41/0645—Management of faults, events, alarms or notifications using root cause analysis; using analysis of correlation between notifications, alarms or events based on decision criteria, e.g. hierarchy, tree or time analysis by additionally acting on or stimulating the network after receiving notifications
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/12—Network monitoring probes

Definitions

  • the present invention relates to the technical field of industrial networks and information security, in particular to a monitoring method, device and system for an industrial control system and a computer-readable medium.
  • An industrial control system is widely used for remote monitoring and/or for controlling an industrial process in the industrial fields such as manufacturing, electrical power, food and medicine.
  • Gartner applies the operation technology (OT) to ICSs and uses hardware and software for security detections so as to monitor and control physical devices and industrial processes in enterprises.
  • OT systems, ICSs and systems for monitoring and/or controlling industrial devices and/or industrial processes are all called "industrial control systems" below.
  • a traditional industrial control system is often designed into a closed system in consideration of production, operation and stability and therefore the security feature is less often emphasized. It has been considered for a long time that industrial control systems depending on proprietary hardware and networks can resist network attacks.
  • IT information technology
  • industrial control systems are gradually turned into open systems.
  • the operation mode of joint ventures, allied companies and service outsourcing companies also quickens the opening of industrial control systems.
  • the phenomenon of network intrusion attacks has become increasingly prominent. More and more hackers and malicious software have threatened open industrial control systems, thus increasing the probability of open industrial control systems being attacked.
  • a monitoring method for an industrial control system may be implemented by a monitoring device deployed in an industrial control system.
  • the monitoring device first obtains first network traffic transmitted in the industrial control system in a passive monitoring manner, then determines whether it is necessary to monitor the industrial control system in an active probe manner according to characteristics of industrial devices in the industrial control system in the first network traffic, and if determining that it is necessary to monitor the industrial control system in an active probe manner, determines a target industrial device according to the characteristics of the industrial devices in the industrial control system in the first network traffic, sends third network traffic to the determined target industrial device, and obtains second network traffic sent by the target industrial device in response to the third network traffic.
  • the monitoring device can determine a target industrial device and/or characteristics to be further obtained. Therefore, the monitoring device can obtain targeted network traffic in an active probe manner, avoiding the production of a large amount of extra network traffic and influencing to a lesser extent the running of the industrial control system and industrial devices. Meanwhile, the monitoring device can obtain required characteristics. With the running of the industrial control system less influenced, the monitoring device effectively obtains and analyzes characteristics.
  • the monitoring device determines whether it is necessary to adopt an active probe manner for the industrial control system to obtain second network traffic transmitted in the industrial control system and uses the newly accessed industrial device as the target industrial device.
  • the monitoring device determines whether it is necessary to adopt an active probe manner for the industrial control system to obtain second network traffic transmitted in the industrial control system and uses the industrial device whose characteristics are changed as the target industrial device.
  • the monitoring device uses the newly accessed industrial device and the industrial device whose characteristics are changed as the target industrial device, and obtains the characteristic of the target industrial device in an active probe manner.
  • the active probe can be more targeted, the dynamic changes of the industrial control system can be tracked in real time and the latest information of the industrial control system can be obtained.
  • the monitoring configuration may be first determined to be one of the following for the method: passive monitoring configuration, active monitoring configuration, and active and passive combined monitoring configuration. If determining the monitoring configuration as the active and passive combined monitoring configuration, the monitoring device performs the steps of obtaining first network traffic transmitted in the industrial control system in a passive monitoring manner and determining whether it is necessary to monitor the industrial control system in an active probe manner according to characteristics of industrial devices in the industrial control system in the first network traffic, and if determining that it is necessary to monitor the industrial control system in an active probe manner, performs the steps of determining a target industrial device according to the characteristics of the industrial devices in the industrial control system in the first network traffic, sending third network traffic to the determined target industrial device, and obtaining second network traffic sent by the target industrial device in response to the third network traffic; if determining the monitoring configuration as the passive monitoring configuration, the monitoring device monitors the industrial control system only in a passive monitoring manner; if determining the monitoring configuration as the active monitoring configuration, the monitoring device monitors the industrial control system only in an active probe manner.
  • the monitoring manner can flexibly be configured to adapt to different application scenarios.
  • the monitoring device may further send at least one of the following contents to an analysis center for an analysis and/or to a workstation through a third interface:
  • the analysis center or workstation can make further analyses.
  • a monitoring device for an industrial control system may comprise: at least one memory configured to store a computer-readable instruction, a first interface, a second interface and at least one processor coupled with the at least one memory.
  • the at least one processor is configured to: obtain first network traffic transmitted in the industrial control system through the first interface in a passive monitoring manner; determine whether it is necessary to monitor the industrial control system in an active probe manner according to characteristics of industrial devices in the industrial control system in the first network traffic; if determining that it is necessary to monitor the industrial control system in an active probe manner, determine a target industrial device according to the characteristics of the industrial devices in the industrial control system in the first network traffic, send third network traffic to the determined target industrial device through the second interface, and obtain, through the second interface, second network traffic sent by the target industrial device in response to the third network traffic.
  • the monitoring device can determine a target industrial device and/or characteristics to be further obtained. Therefore, the monitoring device can obtain targeted network traffic in an active probe manner, avoiding the production of a large amount of extra network traffic and influencing to a lesser extent the running of the industrial control system and industrial devices. Meanwhile, the monitoring device can obtain required characteristics. With the running of the industrial control system less influenced, the monitoring device effectively obtains and analyzes characteristics.
  • the at least one processor when determining whether it is necessary to monitor the industrial control system in an active probe manner according to characteristics of industrial devices in the industrial control system in the first network traffic, is specifically configured to determine whether it is necessary to adopt an active probe manner for the industrial control system to obtain second network traffic transmitted in the industrial control system if determining that a new industrial device is accessed to the industrial control system according to the characteristics of the industrial devices in the industrial control system in the first network traffic; when determining a target industrial device, the at least one processor is specifically configured to use the newly accessed industrial device as the target industrial device.
  • the at least one processor when determining whether it is necessary to monitor the industrial control system in an active probe manner according to characteristics of industrial devices in the industrial control system in the first network traffic, is specifically configured to determine whether it is necessary to adopt an active probe manner for the industrial control system to obtain second network traffic transmitted in the industrial control system if determining that the characteristics of the industrial devices in the industrial control system are changed according to the characteristics of the industrial devices in the industrial control system in the first network traffic; when determining a target industrial device, the at least one processor is specifically configured to use the industrial device whose characteristics are changed as the target industrial device.
  • the monitoring device uses the newly accessed industrial device and the industrial device whose characteristics are changed as the target industrial device, and obtains the characteristic of the target industrial device in an active probe manner.
  • the active probe can be more targeted, the dynamic changes of the industrial control system can be tracked in real time and the latest information of the industrial control system can be obtained.
  • the at least one processor is further configured to determine the monitoring configuration as one of the following:
  • the monitoring manner can flexibly be configured to adapt to different application scenarios.
  • the device may further comprise a third interface
  • the at least one processor is further configured to send at least one of the following contents to an analysis center for an analysis and/or to a workstation through a third interface:
  • the analysis center or workstation can make further analyses.
  • a computer readable medium is provided, a computer-readable instruction is stored in the computer-readable medium, and a processor executes the method provided in the first aspect when invoking the computer-readable instruction.
  • a monitoring system for an industrial control system comprises: at least one monitoring device and an analysis center and/or a workstation, wherein the at least one monitoring device is configured to obtain first network traffic transmitted in the industrial control system in a passive monitoring manner; determine whether it is necessary to monitor the industrial control system in an active probe manner according to characteristics of industrial devices in the industrial control system in the first network traffic, and if determining that it is necessary to monitor the industrial control system in an active probe manner, determine a target industrial device according to the characteristics of the industrial devices in the industrial control system in the first network traffic, send third network traffic to the determined target industrial device, and obtain second network traffic sent by the target industrial device in response to the third network traffic; send at least one of the following contents to the analysis center for an analysis and/or to the workstation: the first network traffic, the second network traffic and a result of an analysis of the industrial control system according to the first network traffic and the second network traffic.
  • an industrial control system has the following characteristics:
  • the environment of the industrial control system becomes increasingly complex and changes dynamically. Therefore, there is an increasing demand on the automatic detection and monitoring of equipment and the visualization of the establishment and maintenance of the environment of the industrial control system.
  • a monitoring method, device and system for an industrial control system are provided based on the above-mentioned characteristics of the industrial control system.
  • a distributed monitoring device for example, network sensor
  • the visualization of the industrial control system is realized by obtaining characteristics of industrial devices in the industrial control system.
  • an industrial control system is used for remote monitoring and/or for controlling an industrial process.
  • the industrial control system is also known as OT system or ICS.
  • Examples of an industrial control system include a supervisory control and data acquisition (SCADA) system, a distributed control system (DCS), a computer numerical control (CNC) system (including computerized mechanical tool) and a scientific device (for example, a digital oscilloscope).
  • SCADA supervisory control and data acquisition
  • DCS distributed control system
  • CNC computer numerical control
  • scientific device for example, a digital oscilloscope
  • An industrial control system may include but is not limited to the following industrial devices:
  • the monitoring device can obtain the characteristics of industrial devices from the acquired network traffic, and these characteristics include but are not limited to: basic characteristics of Ethernet, Internet protocol (IP), transport control protocol (TCP) and data datagram protocol (UDP), for example, media access control (MAC) address, IP address, and TCP/UDP port No. (corresponding to the service provided by an industrial device 30).
  • IP Internet protocol
  • TCP transport control protocol
  • UDP data datagram protocol
  • MAC media access control
  • IP address IP address
  • IP address IP address
  • TCP/UDP port No. corresponding to the service provided by an industrial device 30.
  • Information such as device type, hardware version and firmware version may be acquired from the payload in a link layer discovery protocol frame, and information such as type identifier may be acquired from the OT protocol of Siemens S7Comm.
  • the monitoring manners for a network or a system are roughly classified into an active probe manner and a passive monitoring manner.
  • Either the active probe manner or the passive monitoring manner includes various types, and various types are respectively applicable to specific scenarios because their availability, characteristics, capabilities and disadvantages are different.
  • the feedback of a network is measured or monitored by sending network traffic of a detection to the network. Since network devices can actively be accessed, more device characteristics can be obtained in the active probe manner. However, since extra network traffic needs to be sent in the network, a large amount of extra network traffic may be produced if the network is not well understood, thus influencing the normal running of the network and the network devices therein.
  • the passive monitoring manner only the network traffic transmitted over the network is monitored, and no extra network traffic will be injected into the target network by using a device connected to the network to capture the network traffic for an analysis.
  • the monitored network traffic contains no characteristics required for devices and assets, it is difficult to obtain a large amount of network traffic available for analyses in the passive monitoring manner and the applications of the passive monitoring manner are also restricted.
  • the advantages of the active probe manner and the passive monitoring manner are combined.
  • the operator of the industrial control system can learn the condition of the network security in real time, realizing security situation awareness.
  • the running of the industrial control system is less influenced.
  • the solution provided based on the embodiments of the present invention can realize the statement of assets, topology discovery, change monitoring, network/application behavior monitoring and operation monitoring, realize continuous monitoring of an industrial control system and effectively improve the visibility of the industrial control system.
  • Figs. 1A and 1B show the structure of the monitoring system 100 for an industrial control system 200 provided in one embodiment of the present invention.
  • the monitoring system 100 may comprise at least one monitoring device 10 and at least one analysis center 20 (as shown in Fig. 1A ) or at least one workstation 20' (as shown in Fig. 1B ). Wherein, the monitoring system 100 may also comprise one analysis center 20 and at least one workstation 20'.
  • the at least one monitoring device 10 can be deployed in the industrial control system 200.
  • one or more monitoring devices 10 may be configured for each local area network (LAN), wherein one LAN may comprise one or more interconnected switches and/or routers.
  • the network interfaces of the monitoring device 10 for monitoring the industrial control system 200 are connected to a LAN, and port mirroring is configured on the switches or routers of the LAN or a monitoring device is deployed on the switches or routers by use of wire monitoring to acquire the network traffic (including incoming and outgoing network traffic in the LAN) transmitted in the LAN.
  • one monitoring device 10 may comprise 2 to 3 interfaces in terms of hardware composition:
  • an engineer 60 can obtain the above-mentioned characteristics through a workstation 20'.
  • the second interface 111b and the third interface 111c may also be implemented by a hardware interface. That is to say, the monitoring device 10 may obtain network traffic in the active probe manner through the third interface 111c.
  • the monitoring device 10 may further comprise at least one memory 112 and at least one processor 113 coupled with the at least one memory 112.
  • the at least one memory 112 is configured to store a computer-readable instruction, and alternatively, store network traffic obtained by the monitoring device 10 and the result of an analysis of the network traffic obtained by the monitoring device 10.
  • the at least one processor 113 is configured to implement the monitoring and analysis functions of the monitoring device 10 when executing the computer-readable instruction stored in the at least one memory 112. For example, the at least one processor obtains network traffic and sends network traffic and the result of an analysis through the above-mentioned interfaces. Again for example, the at least processor implements the function of monitoring configuration.
  • the monitoring device 10 may have the following three monitoring configurations:
  • the monitoring configurations may be set through a software switch.
  • a monitoring configuration may be set in advance in the factory or may flexibly be changed in service according to the practical application scenario.
  • the monitoring device 10 monitors the industrial control system 200 only in the passive monitoring manner.
  • the monitoring device 10 only needs to comprise the above-mentioned first interface 111a, and alternatively may further comprise the above-mentioned third interface 111c.
  • the monitoring device 10 analyzes the obtained network traffic, for example, obtains characteristics of industrial devices and sends the obtained characteristics of industrial devices to an analysis center 20 and/or a workstation 20' through the third interface 111c.
  • the monitoring device 10 monitors the industrial control system 200 only in the active probe manner.
  • the monitoring device 10 only needs to comprise the above-mentioned second interface 111b and third interface 111c.
  • the monitoring device 10 analyzes the network traffic obtained in the active probe manner, for example, performs a depth analysis to extract characteristics of industrial devices and sends the obtained characteristics of industrial devices to an analysis center 20 and/or a workstation 20' through the third interface 111c.
  • the monitoring device 10 monitors the industrial control system 200 only in the active and passive combined manner.
  • the monitoring configuration is the active and passive combined monitoring configuration 93
  • the monitoring device 10 monitors the industrial control system 200 only in the active and passive combined manner.
  • the composition of the monitoring system 100 and the monitoring configurations of the monitoring device 10 are described above.
  • the monitoring method provided by the embodiments of the present invention is described below in combination with Fig. 2 . As shown in Fig. 2 , the method may comprise the following steps:
  • Step S201 the monitoring device 10 determines a monitoring configuration.
  • the monitoring configuration may be one of the following configurations:
  • the monitoring configuration of the monitoring device 10 may be set in advance before the monitoring device is 10 deployed or after the monitoring device 10 is deployed in the industrial control system 200.
  • the monitoring configuration of the monitoring device 10 may be changed when the monitoring device 10 is in service.
  • Step S201 is not a required step.
  • a monitoring device 10 may adopt only one fixed monitoring configuration to run. In this case, this step is not required to determine the monitoring configuration.
  • step S201 After performing step S201, if the monitoring configuration is determined to be the passive monitoring configuration 91, the monitoring device performs step S206, if the monitoring configuration is determined to be the active monitoring configuration 92, the monitoring device performs step S207, and if the monitoring configuration is determined to be the active and passive combined monitoring configuration 93, the monitoring device performs step S202.
  • the monitoring device 10 obtains first network traffic 81 transmitted in the industrial control system 200 in the passive monitoring manner.
  • the monitoring device 10 may listen to the first interface 111a for full packet capture.
  • the monitoring device 10 may store the first network traffic 81 in a network traffic library.
  • the network traffic library may be located in the monitoring device 10 or may be located in a device connected with the monitoring device 10.
  • the monitoring device 10 obtains second network traffic 82 transmitted in the industrial control system 200 in the active probe manner for the target industrial device 30 in the industrial control system 200.
  • the monitoring device 10 may obtain second network traffic 82 for one target industrial device 30 or a plurality of target industrial devices 30.
  • the monitoring device 10 may also store the second network traffic 82 in a network traffic library.
  • the network traffic library may be located in the monitoring device 10 or may be located in a device connected with the monitoring device 10.
  • the network traffic library may be the same as or different from the network traffic library used to store the first network traffic 81.
  • Step S203 may be performed in different modes, including but not limited to:
  • the monitoring device 10 After obtaining the first network traffic 81, the monitoring device 10 attempts to obtain characteristics of industrial devices 30 in the industrial control system 200 from the first network traffic 81. For example, the monitoring device 10 may obtain the characteristics of one industrial device 30 from the first network traffic 81 or may obtain the characteristics of a plurality of industrial devices 30 from the first network traffic 81. Then, the monitoring device 10 determines whether it is necessary to monitor the industrial control system 200 in the active probe manner according to the obtained characteristics of the industrial devices 30. For example, if the obtained characteristics of the industrial devices 30 from the first network traffic 81 satisfy the analysis requirements, the monitoring device determines that it is not necessary to monitor the industrial control system 200 in the active probe manner, and otherwise, the monitoring device determines that it is necessary to further monitor the industrial control system 200 in the active probe manner.
  • the monitoring device determines target industrial devices 30 according to the characteristics of industrial devices 30 in the industrial control system 200 in the first network traffic 81. For example, if the first network traffic 81 only contains the characteristics of a part of industrial devices 30 in the monitored LAN, the monitoring device can determine the other industrial devices 30 in the LAN to be target industrial devices 30.
  • the monitoring device determines the industrial device 30 to be the target industrial device 30.
  • the monitoring device can obtain the characteristics not contained in the first network traffic 81 but required for analyses for the target industrial device 30.
  • the monitoring device may send third network traffic 83 to the target industrial devices 30 and obtain second network traffic 82 sent by the target industrial devices in response to the third network traffic 83.
  • the monitoring device may directly obtain the above-mentioned characteristics in the passive monitoring manner. If the industrial devices 30 do not support PROFIENT or are accessed to an adjacent industrial switch, the monitoring device can obtain only the basic characteristics such as IP address and MAC address in the passive monitoring manner. In this case, the monitoring device needs to further obtain more characteristics in the active probe manner.
  • the monitoring device 10 can determine a target industrial device 30 and/or characteristics to be further obtained. Therefore, the monitoring device can obtain targeted network traffic in an active probe manner, avoiding the production of a large amount of extra network traffic and influencing to a lesser extent the running of the industrial control system 200 and industrial devices 30. Meanwhile, the monitoring device can obtain required characteristics. With the running of the industrial control system 200 less influenced, the monitoring device effectively obtains and analyzes characteristics.
  • the monitoring device 10 uses the newly accessed industrial device 30 as the target industrial device 30 and obtains second network traffic 82 in the active probe manner for the target industrial device 30.
  • the monitoring device 10 determines that it is necessary to obtain second network traffic 82 transmitted in the industrial control system 200 in the active probe manner and uses the newly accessed industrial device 30 as the target industrial device 30.
  • the monitoring device 10 uses the industrial device 30 whose characteristics are changed as the target industrial device 30 and obtains second network traffic 82 in the active probe manner for the target industrial device 30. For example, when detecting that an industrial device 30 is online/offline, the software/firmware is upgraded or patched, or the configuration parameters are changed, the monitoring device can obtain the second network traffic 82 in the active probe manner for the industrial device 30.
  • the monitoring device 10 determines that it is necessary to obtain second network traffic 82 transmitted in the industrial control system 200 in the active probe manner and uses the industrial device 30 whose characteristics are changed as the target industrial device 30.
  • the monitoring device 10 can periodically obtain second network traffic 82 transmitted in the industrial control system 200 in the active probe manner for the target industrial device 30 in the industrial control system 200. For example, the monitoring device obtains second network traffic every 24 hours.
  • the monitoring device 10 can obtain second network traffic 82 sent by the target industrial device 30 in response to third network traffic 83 by sending third network traffic 83 to the target industrial device 30.
  • the monitoring device 10 can send a PROFINET DCP Ident_ Req broadcast frame as third network traffic 83 for an active probe. After receiving the broadcast frame, any industrial device 30 supporting the PROFINET protocol will respond by sending an Ident_ Ok frame containing characteristics such as device type, device name and IP address.
  • the monitoring device 10 can send a Read- SZL protocol data unit (PDU) as third network traffic 83 for an active probe after establishing a complete S7Comm communication channel.
  • PDU Read- SZL protocol data unit
  • the monitoring device 10 can first establish a TPKT channel through negotiation, and then establish a complete S7Comm communication channel. Then, the monitoring device can obtain the characteristics of the probed industrial device 30, such as device type, hardware version and firmware version.
  • the monitoring device 10 can utilize SNMP Get and Getnext packets to obtain the descriptive information of the industrial device 30, port information of an industrial switch, network interface configuration information such as IP address, mask and gateway, MAC address connected with the industrial switch, and open TCP/IP port No. (or service) on the industrial device 30.
  • SNMP simple network management protocol
  • the monitoring device 10 obtains network traffic in the active probe manner in step S206. Similar to the method in step S202, the specific method of obtaining network traffic is not described here again.
  • the monitoring device 10 obtains network traffic in the active probe manner in step S207. Similar to the method of obtaining network traffic in the active probe manner in step S203, the specific method of obtaining network traffic is not described here again.
  • the monitoring device 10 analyzes the obtained network traffic.
  • the monitoring device 10 analyzes the network traffic obtained in the passive monitoring manner, that is, analyzes the network traffic obtained in step S206.
  • the result of the analysis may be stored in an analysis result library.
  • the characteristics of industrial devices obtained from the analysis are stored in the analysis result library.
  • the analysis result library may be located in the monitoring device 10 or may be located in a device connected with the monitoring device 10, and may be the same as or different from the network traffic library for storing obtained network traffic.
  • the monitoring device 10 analyzes the network traffic obtained in the active probe manner, that is, analyzes the network traffic obtained in step S207.
  • the result of the analysis may be stored in an analysis result library.
  • the characteristics of industrial devices obtained from the analysis are stored in the analysis result library.
  • the analysis result library may be located in the monitoring device 10 or may be located in a device connected with the monitoring device 10, and may be the same as or different from the network traffic library for storing obtained network traffic.
  • the monitoring device 10 may analyze only the network traffic obtained in the passive monitoring manner, that is, analyze first network traffic 81 obtained in step S202, or may analyze only the network traffic obtained in the active probe manner, that is, analyze second network traffic 82 obtained in step S203, or may analyze both the network traffic obtained in the active probe manner and the network traffic obtained in the passive monitoring manner, that is, analyze both first network traffic 81 obtained in step S202 and second network traffic 82 obtained in step S203.
  • the result of the analysis may be stored in an analysis result library.
  • the characteristics of industrial devices obtained from the analysis are stored in the analysis result library.
  • the analysis result library may be located in the monitoring device 10 or may be located in a device connected with the monitoring device 10, and may be the same as or different from the network traffic library for storing obtained network traffic.
  • the monitoring device 10 can obtain characteristics of the Ethernet, IP layer and TCP/IP layer of the industrial devices 30 in the network from the obtained network traffic.
  • the obtained characteristics are not limited to those given here only for exemplary purposes.
  • the monitoring device may send the network traffic and/or the result of the analysis obtained in the previous steps to an analysis center 20 for a further analysis.
  • the monitoring device sends the network traffic and/or the result of the analysis to a device used for industrial security analyses on industrial premises, including on-premise security appliances.
  • step S205 the network traffic and/or the result of the analysis obtained in the previous steps may be sent to a workstation 20', and an engineer 60 may further analyze the network traffic and/or the result of the analysis received by the workstation 20'.
  • the engineer may aggregate, prepare and analyze data to further produce the overall characteristics of the industrial control system 200.
  • the analysis center 20 and/or workstation 20' may further provide a graphic user interface (GUI) to demonstrate the asset list and the network topology.
  • GUI graphic user interface
  • Fig. 3 is a schematic diagram of a monitoring device 10 provided by the embodiments of the present invention. As shown in Fig. 3 , the monitoring device 10 may comprise the following modules:
  • an upper limit can be set for the storage space of the industrial device characteristics library 106. When the upper limit is exceeded, previously stored data will be overwritten by newly stored data.
  • the scheduler and analyzer is configured to determine whether the probe 108 needs to obtain further network traffic in the active probe manner based on the network traffic stored in the industrial device characteristics library 106, and obtain richer characteristics therefrom.
  • the scheduler and analyzer 107 may further make an association analysis of characteristics from different industrial devices 30 and infer the connections (network topology) between the monitored industrial switch, router and other industrial devices 30 thereby.
  • the network traffic and characteristics of industrial devices 30 obtained by the scheduler and analyzer 107 may also be stored in the industrial device characteristics library 106.
  • the probe is configured to send a detected packet and/or frame to the LAN 50 the monitoring device 10 is connected to through the second interface 111b based on different characteristics, for example, PROFINENT discovery and configuration protocol (DCP) to further obtain network traffic and then obtain richer characteristics of the industrial devices 30.
  • DCP PROFINENT discovery and configuration protocol
  • the monitoring device 10 may utilize a VPN client to establish a secure VPN channel with an analysis center 20 and/or a workstation 20'.
  • the data access point 110 enables a remote data center and/or a workstation 20' to access the industrial device characteristics library 106 in the monitoring device 10.
  • the monitoring device 10 may adopt a plurality of implementation modes so that the characteristics of industrial devices 30 on the data access point 110 are accessible.
  • the parameters such as IP address and TCP port No. of the analysis center 20 or the workstation 20' are configured in advance and a data collection agent is deployed on the monitoring device 10 so that the characteristics of industrial devices 30 and/or network traffic can automatically be forwarded to the analysis center 20 or the workstation 20'.
  • a RESTful application programming interface (API) or a Web graphic user interface (GUI) is provided for the analysis center 20 and/or workstation 20' for data access.
  • API application programming interface
  • GUI Web graphic user interface
  • the above-mentioned modules can be considered as computer programming modules stored in at least one memory 112, and when invoking computer-readable instructions in these computer programming modules, at least one processor 113 completes the operations of the modules.
  • the industrial device characteristics library 106 may be implemented by computer-readable instructions in terms of data organization and management, and the network traffic and the analysis result stored in the industrial device characteristics library may be stored in at least one memory 112 in terms of hardware.
  • module composition shown in Fig. 3 is only an optional implementation mode. Actually, any module division or implementation mode falls within the scope of protection of the present invention, as long as an industrial control system can be monitored and analyzed in the active probe manner and the passive monitoring manner.
  • Fig. 4 shows an optional implementation mode of the monitoring device 10 provided by the embodiments of the present invention.
  • the monitoring device 10 in this implementation mode may comprise: at least one memory 112, configured to store a computer-readable instruction;
  • the memory 112, the processor 113 and the interfaces may be connected together through a bus.
  • the at least one processor 113 when determining whether it is necessary to monitor the industrial control system 200 in the active probe manner according to characteristics of industrial devices 30 in the industrial control system 200 in the first network traffic 81, the at least one processor 113 is specifically configured to determine whether it is necessary to adopt the active probe manner for the industrial control system 200 to obtain second network traffic 82 transmitted in the industrial control system 200 if determining that a new industrial device 30 is accessed to the industrial control system 200 according to the characteristics of the industrial devices 30 in the industrial control system 200 in the first network traffic 81; when determining a target industrial device 30, the at least one processor 113 is specifically configured to use the newly accessed industrial device 30 as the target industrial device 30.
  • the at least one processor 113 when determining whether it is necessary to monitor the industrial control system 200 in the active probe manner according to characteristics of industrial devices 30 in the industrial control system 200 in the first network traffic 81, the at least one processor 113 is specifically configured to determine whether it is necessary to adopt the active probe manner for the industrial control system 200 to obtain second network traffic 82 transmitted in the industrial control system 200 if determining that the characteristics of industrial devices 30 in the industrial control system 200 are changed according to the characteristics of the industrial devices 30 in the industrial control system 200 in the first network traffic 81; when determining a target industrial device 30, the at least one processor 113 is specifically configured to use the industrial device 30 whose characteristics are changed as the target industrial device 30.
  • the at least one processor 113 is further configured to determine the monitoring configuration as one of the following:
  • the device may further comprise a third interface 111c, and the at least one processor 113 is further configured to send at least one of the following contents to an analysis center 20 for an analysis and/or to a workstation 20' through a third interface 111c:
  • the embodiments of the present invention further provide a computer-readable medium.
  • a computer-readable instruction is stored in the computer-readable medium and a processor executes any above-mentioned method when the computer-readable instruction is executed by the processor.
  • a system or device equipped with a computer-readable storage medium may be provided.
  • Software program codes which can realize the function in any of above-mentioned embodiments are stored in the computer-readable storage medium and the computer or processor of the system or device can read out and execute the computer-readable instruction stored in the computer-readable storage medium.
  • program codes read from the computer-readable storage medium themselves can realize the function in any of the above-mentioned embodiments. Therefore, computer-readable codes and the computer-readable storage medium where computer-readable codes are stored constitute a part of the present invention.
  • Embodiments of computer-readable storage media include floppy disks, hard disks, magneto-optical disks, compact disks (for example, compact disk read-only memory (CD-ROM)), compact disk-recordable (CD-R), compact disk-rewritable (CD-RW), digital video disk-read only memory (DVD-ROM), digital versatile disk-random access memory (DVD-RAM), digital versatile disk-recordable (DVD-RW), digital versatile disk-rewritable (DVD+RW), magnetic tape, non-volatile memory card, and read-only memory (ROM).
  • program codes can be downloaded from the server computer or cloud over a communication network.
  • the embodiments of the present invention provide a monitoring method, device and system for an industrial control system, and a computer-readable medium, and the application scenarios thereof include but are not limited to the following two:
  • the embodiments of the present invention combine the advantages of the active probe manner and the passive monitoring manner and make up for the disadvantages of the two manners. For example, if the passive monitoring manner is adopted, the communication in the industrial control system will not be influenced, but limited characteristics can be obtained. If the active probe manner is adopted, more characteristics can be obtained, but extra network traffic will be injected into the industrial control system. Common scanning will bring about adverse influence on the running of the industrial control system.
  • the advantages and disadvantages of the two manners are considered in the embodiments of the present invention. Not only is the collection of characteristics of industrial devices implemented, but also the adverse influence on the industrial control system is avoided.
  • a target active probe is performed based on the characteristics of industrial devices obtained in the passive monitoring manner, and characteristics of industrial devices are further obtained from necessary network traffic of the industrial control system. Therefore, the advantages of the active probe manner and the passive monitoring manner are considered in the embodiments of the present invention, and the adverse influence of common scanning is avoided.
  • the edge computing solution is applied to the monitoring of the industrial control system.
  • the monitoring device completes major calculation and analysis operations and sends the result of the analysis to an analysis center and/or workstation, avoiding the transmission of a large amount of network traffic. Even without a central analysis center, the monitoring device can work independently.
  • hardware units can mechanically or electrically be realized.
  • a hardware unit can comprise a permanent dedicated circuit or logic (for example, special processor, FPGA, or ASIC) to complete the corresponding operations.
  • a hardware unit may further comprise a programmable logic or circuit (for example, a general processor or other programmable processor) and may complete the corresponding operations through temporary software setting.
  • the specific implementation mode mechanical mode, or dedicated permanent circuit, or circuit which is temporarily set

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Automation & Control Theory (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)
EP18944895.4A 2018-12-26 2018-12-26 Verfahren, vorrichtung und system zur überwachung einer industriesteuerung und computerlesbares medium Active EP3905595B1 (de)

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2018/123911 WO2020132949A1 (zh) 2018-12-26 2018-12-26 用于工业控制系统的监测方法、装置、系统和计算机可读介质

Publications (4)

Publication Number Publication Date
EP3905595A1 true EP3905595A1 (de) 2021-11-03
EP3905595A4 EP3905595A4 (de) 2022-07-20
EP3905595C0 EP3905595C0 (de) 2023-08-30
EP3905595B1 EP3905595B1 (de) 2023-08-30

Family

ID=71127537

Family Applications (1)

Application Number Title Priority Date Filing Date
EP18944895.4A Active EP3905595B1 (de) 2018-12-26 2018-12-26 Verfahren, vorrichtung und system zur überwachung einer industriesteuerung und computerlesbares medium

Country Status (4)

Country Link
US (1) US11418521B2 (de)
EP (1) EP3905595B1 (de)
CN (1) CN113039755B (de)
WO (1) WO2020132949A1 (de)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP7549843B2 (ja) * 2019-01-13 2024-09-12 ストロング フォース アイオーティ ポートフォリオ ２０１６，エルエルシー 産業環境の監視及び管理のための方法、システム、キット、及び装置
CN115550213A (zh) * 2022-08-12 2022-12-30 中国航空无线电电子研究所 一种多场景多模式的dds监控系统
WO2024060245A1 (zh) * 2022-09-23 2024-03-28 西门子股份公司 设备信任等级分析方法、装置、电子设备和存储介质

Family Cites Families (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1825388A4 (de) 2004-11-17 2010-07-28 Univ California System und verfahren zur bereitstellung einer webseite
KR100776828B1 (ko) * 2006-08-25 2007-11-19 고려대학교 산학협력단 유비쿼터스 홈네트워크 환경의 침입탐지 방법, 그 기록 매체 및 유비쿼터스 홈네트워크 환경의 침입탐지 장치
JP2010088031A (ja) * 2008-10-02 2010-04-15 Nec Corp アンダーレイネットワーク障害検知方法及びネットワークシステム
CN102377740A (zh) * 2010-08-12 2012-03-14 西门子公司 一种工业访问控制方法及装置
US9518839B2 (en) * 2013-11-26 2016-12-13 Northrop Grumman Systems Corporation Wavelet based monitoring of system parameters
CN104811437B (zh) * 2015-03-16 2017-12-22 南京麦伦思科技有限公司 一种工业控制网络中生成安全策略的系统和方法
WO2017053806A1 (en) * 2015-09-25 2017-03-30 Acalvio Technologies, Inc. Dynamic security mechanisms
US9854069B2 (en) * 2015-12-01 2017-12-26 Radiflow Ltd. Network security agent
CN106911529A (zh) * 2015-12-22 2017-06-30 国网青海省电力公司 基于协议解析的电网工控安全检测系统
EP3456003A1 (de) * 2016-05-12 2019-03-20 Telefonaktiebolaget LM Ericsson (PUBL) Überwachungssteuergerät und dadurch durchgeführtes verfahren zur überwachung der netzwerkleistung
CN106789177B (zh) * 2016-11-30 2019-09-10 武汉船舶通信研究所 一种网络故障处理的系统
CN110495138B (zh) 2017-05-31 2023-09-29 西门子股份公司 工业控制系统及其网络安全的监视方法
CN107040552A (zh) * 2017-06-13 2017-08-11 上海斗象信息科技有限公司 网络攻击路径预测方法
CN107370732B (zh) 2017-07-14 2021-08-17 成都信息工程大学 基于神经网络和最优推荐的工控系统异常行为发现系统
CN108650225B (zh) * 2018-04-03 2021-03-02 国家计算机网络与信息安全管理中心 一种远程安全监测设备、系统及远程安全监测方法
US10942500B2 (en) * 2018-06-11 2021-03-09 Purdue Research Foundation System architecture and method of processing data therein
CN109067592B (zh) * 2018-08-31 2022-01-18 国网辽宁省电力有限公司电力科学研究院 一种面向智能配用电的智能管控装置及管控方法
CN112671553A (zh) * 2020-11-26 2021-04-16 中国电子科技网络信息安全有限公司 基于主被动探测的工控网络拓扑图生成方法

Also Published As

Publication number Publication date
CN113039755B (zh) 2024-08-27
EP3905595A4 (de) 2022-07-20
US20220046033A1 (en) 2022-02-10
EP3905595C0 (de) 2023-08-30
WO2020132949A1 (zh) 2020-07-02
CN113039755A (zh) 2021-06-25
US11418521B2 (en) 2022-08-16
EP3905595B1 (de) 2023-08-30

Similar Documents

Publication Publication Date Title
US8844041B1 (en) Detecting network devices and mapping topology using network introspection by collaborating endpoints
US11418521B2 (en) Industrial control system monitoring method, device and system, and computer-readable medium
CN102082690B (zh) 一种网络拓扑的被动发现设备及其发现方法
EP3499837A1 (de) Ot-system-überwachungsverfahren, vorrichtung, system und speichermedium
US8898265B2 (en) Determining data flows in a network
CN104580168A (zh) 一种攻击数据包的处理方法、装置及系统
US11888900B2 (en) Cryptographic security audit using network service zone locking
US11336545B2 (en) Network device measurements employing white boxes
WO2021047011A1 (zh) 数据处理方法及装置、计算机存储介质
Tran et al. A network topology-aware selectively distributed firewall control in sdn
CN108173695B (zh) 一种云环境下流量监控系统及方法
CN114465931A (zh) 网络探测方法、装置、电子设备及存储介质
CN112003747A (zh) 云虚拟网关的故障定位方法
US9749150B2 (en) Method and system for monitoring network communications
CN108353027B (zh) 一种用于检测端口故障的软件定义网络系统及方法
US11916972B2 (en) Traffic capture mechanisms for industrial network security
Pfrang et al. On the Detection of Replay Attacks in Industrial Automation Networks Operated with Profinet IO.
CN108933707B (zh) 一种工业网络的安全监控系统及方法
CN114143076B (zh) 一种基于虚拟交换框架的电力物联网安全防护系统
US10904123B2 (en) Trace routing in virtual networks
Chang et al. Enabling situational awareness in operational technology environments through software defined networking
Lontorfos Securely accessing remote sensors in critical infrastructures.
Liu et al. Community Cleanup: Incentivizing Network Hygiene via Distributed Attack Reporting
Kalpana et al. Software-Defined Networking: Research Challenges
Kumbhar et al. Software-Defined Networking: Research Challenges

Legal Events

Date Code Title Description
STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE INTERNATIONAL PUBLICATION HAS BEEN MADE

PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

17P Request for examination filed

Effective date: 20210720

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

DAV Request for validation of the european patent (deleted)
DAX Request for extension of the european patent (deleted)
A4 Supplementary search report drawn up and despatched

Effective date: 20220620

RIC1 Information provided on ipc code assigned before grant

Ipc: H04L 41/0631 20220101ALN20220614BHEP

Ipc: G05B 19/042 20060101ALN20220614BHEP

Ipc: H04L 43/12 20220101ALN20220614BHEP

Ipc: H04L 43/062 20220101ALI20220614BHEP

Ipc: H04L 43/50 20220101ALI20220614BHEP

Ipc: G05B 23/02 20060101AFI20220614BHEP

REG Reference to a national code

Ref country code: DE

Ref legal event code: R079

Ref document number: 602018056796

Country of ref document: DE

Free format text: PREVIOUS MAIN CLASS: H04L0012260000

Ipc: G05B0023020000

Ref country code: DE

Ref legal event code: R079

Ipc: G05B0023020000

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

RIC1 Information provided on ipc code assigned before grant

Ipc: H04L 41/0631 20220101ALN20230427BHEP

Ipc: G05B 19/042 20060101ALN20230427BHEP

Ipc: H04L 43/12 20220101ALN20230427BHEP

Ipc: H04L 43/062 20220101ALI20230427BHEP

Ipc: H04L 43/50 20220101ALI20230427BHEP

Ipc: G05B 23/02 20060101AFI20230427BHEP

INTG Intention to grant announced

Effective date: 20230519

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602018056796

Country of ref document: DE

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

U01 Request for unitary effect filed

Effective date: 20230906

U07 Unitary effect registered

Designated state(s): AT BE BG DE DK EE FI FR IT LT LU LV MT NL PT SE SI

Effective date: 20230911

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20231201

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20231230

U20 Renewal fee paid [unitary effect]

Year of fee payment: 6

Effective date: 20231215

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230830

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20231130

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20231230

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230830

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20231201

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230830

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230830

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230830

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230830

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230830

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230830

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230830

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602018056796

Country of ref document: DE

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

26N No opposition filed

Effective date: 20240603

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230830

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20231226

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230830

REG Reference to a national code

Ref country code: IE

Ref legal event code: MM4A

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20231226

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20231226